LOstorm SL Viewer

Advisory-003 (2026-Sep-02)

back to main website

An issue was identified where Linux users running KDE desktops may notice a failure to save files when the suggested filename contains shell characters (brackets, etc.).

This is an exploitable issue which could lead to code execution when attempting to save maliciously crafted item or object names.

It is recommended to install zenity or unset the XDG_CURRENT_DESKTOP environment variable before running LOstorm as a workaround, or simply avoid saving items or objects with untrusted names.

A future LOstorm version will fix this issue.